Recent content by NUT65

Quite a bummer I can't enable this option, read more about X-Content-Type-Options: nosniff @Microsoft

Actually, after some more testing I cant seem to pin it down to a specific filter. I would probably have to disable all caches... too much work, I'll just switch it off completely.

ModPagespeedEnableFilters remove_comments is the problem. That filter adds the X-Content-Type-Options: nosniff tag. I'll have to find out how/from where... It's strange to me that it doesn't set that same tag when not on an SSL site! Thanks for helping me troubleshoot this.

WOW... mod pagespeed is the problem... that's weird. It only affects the secure site. Test forum running on normal http site. I had switched off all default filters and was just running with: ModPagespeedRewriteLevel PassThrough ModPagespeedEnableFilters combine_css,combine_javascript...

Yea, I'm running mod_pagespeed, but that's also running on my test forum where I have no problems. I'll switch it off for a test...

I'm running a reverse proxy (so no, not visible for users) that serves images from a lighttpd server. But not serving anything from the /data or /internal_date folders.

Yes, but only on the 'normal' images... (not on avatars) when I switched it off, there was no difference. Tested again, but that header is still being set :( Need to get some lunch...

Weird. curl doesn't show it, but it is still showing as a response header in console view. I did search the whole www space for "nosniff", and it only show here: library/XenForo/ViewAdmin/Attachment/View.php: $this->_response->setHeader('X-Content-Type-Options', 'nosniff')...

Nope, still no go... curl -I -H 'X-Content-Type-Options: nosniff' https://www.windowsbbs.com/data/avatars/m/54/54046.jpg HTTP/1.1 200 OK Date: Fri, 20 May 2016 11:36:17 GMT Server: Apache Last-Modified: Fri, 20 May 2016 11:33:32 GMT Accept-Ranges: bytes Content-Length: 2680 Cache-Control...

This is nuts! I'm finding answers on how to enable it, but how on earth do you disable this? Nothing in any of the Apache files... a text search for "nosniff" on the server also negative... soo file checking. It is set in library/XenForo/ProxyOutput.php That explains it... I'm using the image...

I've been testing for the last 4 hours... silly thing is that on my test install (which is on a non https domain) there is no problem. I switched off everything under the sun, so both domains had the same settings... I see that there is this "X-Content-Type-Options: nosniff" on the secure site...

So I'm running a RHEL 6 server with php 5.3.3 and GD 2.0.34. The issue was happening with APC cache (3.1.13) and is also happening after switching to XCache (3.0.4)..

OK, I have a weird problem I can't seem to find the cause for. Avatars uploaded as .gif are not displaying in IE, but fine in any other browser. The avatar itself shows fine in IE when viewed with just the link for the avatar, but not when it should be displayed in the forum. Here's my test...

I'm willing to chip in too...

Yea, this is something that I would need too.